SEC and CFTCs: Clarity for Issuers. Complexity for Intermediaries

Every major law firm in the country has now published their take on the SEC and CFTCs March 17 joint interpretive release. Most of them say roughly the same thing: issuers finally have clarity. The five-tier taxonomy is here. Regulation by enforcement is over. Go build. Great.

That’s not wrong. But it stops at the issuer and calls it a day. The work now begins for intermediaries — exchanges, token management platforms, custodians, and transfer agents — who are left with the interpretive and operational challenges the guidance doesn’t resolve: monitoring assets whose classification can change over time, conducting diligence on the transactional history behind tokens they accept, and managing distributor-side exposure that the issuer-focused safe harbors don’t squarely cover. The March 17 release didn’t end the hard questions. It reassigned them to intermediaries.

What the Guidance Actually Did for Intermediaries

To be fair, the release did provide meaningful guidance to intermediaries. Jurisdiction of exchanges and trading platforms that deal exclusively in named digital commodities is confirmed as CFTC, not SEC. For platforms listing a mix of assets, the guidance doesn’t eliminate SEC exposure, but it does clarify which assets trigger it.

Also, the five-tier taxonomy gives intermediaries a shared vocabulary with their clients. When a project comes to a token management platform asking to set up a vesting schedule or distribution workflow, there’s now a common framework for the threshold question: what kind of token is this? That matters operationally. It provides structure to the diligence conversation.

So the guidance delivered real value to intermediaries. The question is what it left open — and that’s where the complexity lives.

The Classification Problem Doesn’t End at Issuance

The guidance establishes that token classification isn’t static. A crypto asset that was sold as part of an investment contract — and therefore subject to securities laws — can, over time, cease to be so, as the underlying network becomes sufficiently decentralized and purchasers no longer rely on the efforts of a central team for profit. This is genuinely useful doctrine. It resolves years of debate about whether early-stage tokens and mature network tokens should be treated the same way.

The problem for intermediaries is that this dynamism doesn’t resolve itself. Someone has to track it.

For an exchange, listing decisions have always required legal analysis. But historically the question was binary: security or not? Now the answer for a given asset might be *not yet, but watch the network’s maturity* — or *was, but may not be anymore.* That’s not a one-time determination. It’s an ongoing compliance obligation, and it lives on the intermediary’s plate.

Token management platforms face a related version of this. They hold vesting tables, restricted token grant agreements, and distribution schedules built under assumptions the guidance has now revised. Existing documentation may need to be re-examined — not because deals were structured incorrectly, but because the legal landscape underneath them has shifted.

The Investment Contract Wrapper Problem

One of the guidance’s most important clarifications is also one of its most operationally underappreciated: a token itself is not a security, but *how it was sold* can still create securities law exposure. The asset and the transaction are analyzed separately.

For issuers, this is a clean distinction to apply prospectively. For intermediaries, it creates a layered diligence obligation. An exchange or custodian taking on a token isn’t just evaluating the token — it’s evaluating the history of how that token entered circulation. Was there a SAFT? A token warrant? Promises made to early purchasers about the team’s future efforts?

This isn’t novel legal doctrine — it tracks Howey — but the guidance now codifies it in a way that makes ignoring it harder to defend. Intermediaries who accept tokens without understanding their transactional history are accepting risk they may not be pricing.

Airdrops and Staking: Clarity for Issuers, Ambiguity for Distributors

The guidance’s treatment of airdrops and staking has been widely praised, and appropriately so. Gratuitous airdrops of non-security tokens are not securities transactions. Protocol staking isn’t an investment contract. These are meaningful safe harbors.

But the guidance addresses these activities primarily from the issuer’s vantage point. It is less clear about what happens when a third-party platform is executing the distribution. Airdrops don’t flow through exchanges — they go directly from issuers to wallets, typically through token management infrastructure that handles the batching, scheduling, and on-chain mechanics. The platform in that workflow isn’t a passive pipe. It’s making operational decisions about timing, eligibility, and execution that have legal texture.

If the underlying token is later determined to have been misclassified — i.e. placed in the wrong category under the five-tier taxonomy — the distributor’s role in that transaction doesn’t disappear. The guidance doesn’t squarely address this exposure. It probably doesn’t need to in its current form; further rulemaking is explicitly anticipated. But token management platforms that build airdrop and staking workflows based on the March 17 release without accounting for that open question are building on an incomplete foundation.

Built to Flex

The guidance describes itself as a “first step.” The CLARITY Act is approaching a Senate Banking Committee markup but outstanding issues — ethics provisions, illicit finance concerns, and the lingering stablecoin yield debate — mean the final legislative framework is still taking shape. More SEC rulemaking is coming. The five-tier taxonomy will be tested in practice and refined.

For intermediaries, the takeaway isn’t that the guidance is inadequate — it’s genuinely a significant step forward. The takeaway is that the compliance infrastructure they build in response to it needs to be designed for iteration, not locked to a single regulatory snapshot.

That means modular classification workflows. Ongoing monitoring obligations for assets whose status may shift. Diligence protocols that look at transactional history, not just the token itself. Legal documentation that anticipates reclassification.

For further support reach out to Jake Prudhomme, Corporate & Digital Assets Partner at gunnercooke. Find out more about Jake here.